How to troubleshoot this error SOCKET-2-SOCK_RECV_ERR?

[patricianet]

I have a bunch of these messages in my log on my 3850 switch. How should I troubleshoot this? 

*Aug 10 09:20:40.141: *%SOCKET-2-SOCK_RECV_ERR:Switch 1 R0/0: wcm: Error parsing from CAPWAP socket
*Aug 10 09:20:45.327: *%SOCKET-2-SOCK_RECV_ERR:Switch 1 R0/0: wcm: Error parsing from CAPWAP socket
*Aug 10 09:20:47.359: *%SOCKET-2-SOCK_RECV_ERR:Switch 1 R0/0: wcm: Error parsing from CAPWAP socket
*Aug 10 09:20:50.808: *%SOCKET-2-SOCK_RECV_ERR:Switch 1 R0/0: wcm: Error parsing from CAPWAP socket
*Aug 10 09:20:52.030: *%SOCKET-2-SOCK_RECV_ERR:Switch 1 R0/0: wcm: Error parsing from CAPWAP socket
*Aug 10 09:20:54.147: *%SOCKET-2-SOCK_RECV_ERR:Switch 1 R0/0: wcm: Error parsing from CAPWAP socket
*Aug 10 09:21:08.255: *%SOCKET-2-SOCK_RECV_ERR:Switch 1 R0/0: wcm: Error parsing from CAPWAP socket
*Aug 10 09:21:10.072: *%SOCKET-2-SOCK_RECV_ERR:Switch 1 R0/0: wcm: Error parsing from CAPWAP socket
*Aug 10 09:21:12.080: *%SOCKET-2-SOCK_RECV_ERR:Switch 1 R0/0: wcm: Error parsing from CAPWAP socket
*Aug 10 09:21:15.091: *%SOCKET-2-SOCK_RECV_ERR:Switch 1 R0/0: wcm: Error parsing from CAPWAP socket[...It occurred 2 times/sec!.]
*Aug 10 09:21:17.067: *%SOCKET-2-SOCK_RECV_ERR:Switch 1 R0/0: wcm: Error parsing from CAPWAP socket

[RichardAtkin]

Can you provide context? What WLC? What AP? What Software?  Are APs local to WLC or remote?  New install or have you made changes recently?

[patricianet]

WLC: 5520

WAP: 3802i

Software Version: 8.5.131.0

The software was upgraded about 2 weeks ago. No other changes have been made. The access points are local and connected to a 3850 switch via the mGig ports. I've seen this message before with the 8.2 code version also. 

[kyunghun15]

Did you change the settings on the l3 switch? l3 switch Check the ip routing config.

[radavidson]

The switch is config'd for static routing and I haven't made any recent config changes. Is there some specific aspect of ip routing that I should check?

Thx!

[kyunghun15]

I did not have the ip routing command on the l3 switch. I have fixed the ip routing command.

switch (config) # ip routing <- check

[radavidson]

Yes, ip routing is config'd. The error message references a CAPWAP issue which is part of the Wireless Lan Controller capability and not being used.

[teljxr1]

I'm getting the same intermittent errors.  I'm using a Cisco 5520 WLC on 8.5.131.0 as well and using both 3502i AP's (to be decommissioned shortly) as well as 2802i's.  The messages are coming from a 3850 switch stack on Version 16.3.6....

[radavidson]

I experience the same error messages on Cisco 3650-48TS-S IOS XE 16.03.06. I'm not using the WLC capability of the 3650, nor do I have wireless in the environment. Is this a bug?

[chase.cameron]

I am in a similar situation; no wireless in our environment and running the same IOS XE version.  I am curious if you discovered a way to silence the alert?  Appears to be harmless but I still don't like seeing it :-) 

Thanks,

Chase

[akalisiak]

Having same issue on 3850 stacks running 16.3.6, but this has been going on for a while. no Cisco wireless in this environment, almost always coincides with our vulnerability scans, and our syslog servers become flooded with hundreds of thousands of CAPWAP alerts.

TAC suggested logging discriminators which didn't appear to help. Next step was to filter it at the syslog server, which doesn't save wasted cycles processing buggy but at least doesn't flood our mailboxes.

Anxious to see a resolution on this one

[radavidson]

I've also observed that this happens during vulnerability scans.

[dave.reid]

Me too. I landed here when researching that log message. Sure enough, these messages came in the middle of some other complaints that I already know result from the vulnerability scan.

[raguilara]

Did the TAC give any response to the case?

Regards.

[radavidson]

I never opened a TAC Case on this issue. I've observed that this occurs during vulnerability scans.